What your Bluetooth devices reveal

Original Article ↗ Hacker News Discussion ↗

Early Bluetooth “people watching” & bluejacking

  • Several recalled early-2000s habits: scanning for nearby devices on trains or in malls, matching device names to people, and even pranking (e.g., pushing calendar alarms, sending unsolicited files/“bluejacking”).
  • Custom device names were common and often highly identifying; some still play with joke names (fake police vans, dictators, sex toys, etc.).

Retail spam, ads, and traffic monitoring

  • People describe malls and shops blasting unsolicited Bluetooth file-transfer prompts, sometimes abused for malware, which pushed users to turn BT off.
  • Multiple comments confirm commercial tracking: malls, department stores, grocery chains, airports, and car dealerships use WiFi/Bluetooth to measure dwell time, movement patterns, and repeat visits, sometimes linked to loyalty apps or campaigns.
  • Bluetooth and toll transponder IDs are used by road authorities to infer traffic speeds; similar systems exist in several regions and at festivals.
  • Some note EU rules supposedly forbid individual tracking, but others say it still happens under “anonymized” or safety pretexts.

Home and neighborhood fingerprinting

  • HomeAssistant and similar tools easily log neighbors’ devices and presence (including Bluetooth toothbrushes), unintentionally exposing routines.
  • Simple setups (ESP32, Pi) could correlate MACs with faces at a front door and profile visitors over time.

Cars, TPMS, and other radios

  • Car WiFi/BT SSIDs often reveal owner and model; wardriving apps show this at scale.
  • Tire pressure sensors and even RFID-tagged tires broadcast unique identifiers useful for vehicle tracking, though some argue plates and CCTV already dominate.

Medical, IoT, and wearables

  • Examples include pacemakers, CPAP machines, water meters, and sex toys broadcasting via BLE.
  • Debate over design tradeoffs: broadcast-only radios can save power and reduce attack surface, but still leak metadata; others argue for NFC-style activation or better encryption despite cost pressures.

MAC randomization and technical limits

  • Bluetooth has “resolvable private addresses” and phones/WiFi now often randomize MACs, but commenters note:
    • Rotation can be correlated over time,
    • Device types and traffic patterns still fingerprint users, and
    • Many accessories use static IDs.

User countermeasures and OS behavior

  • Some keep BT/WiFi off and only enable when needed, citing both privacy and battery gains (especially since “Find My”-style networks piggyback on BT).
  • GrapheneOS can auto-disable radios after inactivity; iOS and Android have partial/hidden behaviors (Control Center only “disconnects,” auto-reenable at set times/locations).
  • People share shortcuts/automation (“store mode”) to kill radios before entering shops.

Threat models, art, and ethics

  • Speculative uses include burglar tools that log presence/absence, and art installations that confront passersby with their historical visits or purchased data.
  • Some argue Bluetooth tracking is just another form of public observation; others stress the qualitative shift from casual noticing to scalable, automated, long-term surveillance.

Meta: skepticism about the article

  • Multiple commenters call the blog post “LLM slop,” criticizing its tone (“problem nobody talks about,” “not a hacking tool”) and presentation as derivative of other indie blogs.